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Amendments to the Claims : 

The listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims : 

1. (Currently Amended) A method for selectively shadowing only 
accesses to external storage media connected to a computer, the method 
comprising: detecting a data access to an external storage medium; and writing 
a copy of the accessed data to a storage location other than the external storage 
me dium without storing any intermediate copies or fragments thereof on the 
external storage medium : wherein the detecting step comprises intercepting an 
I/O request from the computer to an external storage media drive in which the 
external storage media is inserted. 

2. (Previously presented) The method of claim 1 wherein the access is a 
write operation. 

3. (Previously presented) The method of claim 1 wherein the access is a 
read operation. 

4. (Canceled) 

5. (Previously Presented) The method of claim 1 wherein the I/O request is 
one of the group consisting of a file open or creation request, a write request, a 
file close request, a file system control request and a read request. 
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6. (Previously presented) The method of claim 5 further comprising: 
providing a proxy handler for the I/O request; and executing the proxy handler, 
in response to the detecting step. 

7. (Previously presented) The method of claim [4] 1 wherein the computer 
runs under an operating system and the I/O request is one of the group 
consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE, 
IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ packets. 

8. (Previously presented) The method of claim 7 further comprising: 
providing proxy handlers for the IRP_MJ_CREATE, IRP_MJ_WRITE, 
IRP_MJ_CLOSE and IRP_MJ_FILE_SYSTEM_CONT- ROL packets; and 
executing one of the proxy handlers, in response to the detecting step when the 
I/O request is a respective packet selected from the group consisting of 
IRP_MJ„CREATE, IRP_MJ_WRITE, IRP_MJ_CLOSE and 
IRP_MJ_FILE_SYSTEM_CONTROL packets. 

9. (Previously presented) The method of claim 8 further comprising: 
providing a proxy handlers for the IRP_MJ_READ packet; and executing the 
proxy handlers for the IRP_MJ_READ packet, in response to the detecting step 
when the I/O request is an IRP_MJ_READ packet. 

10. (Previously presented) The method of claim 1 wherein the storage 
location other than the external storage media is a protected storage location. 
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11. (Previously presented) The method of claim 1 further comprising: 
writing the data to the external storage medium after the step of writing a copy 
of the data to a storage location other than the external storage medium. 

12. (Previously presented) The method of claim 1 further comprising: 
attaching to one or more file systems connected to an external storage media 
drive in which the external storage medium is inserted; and wherein the 
detecting step comprises intercepting I/O requests to the one or more file 
systems. 

13. (Previously presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a CD, a 
removable hard disk drive, and a zip disk drive. 

14. (Previously presented) The method of claim 1 further comprising: 
collecting the copy into a database where similar copies are collected; and 
querying the database. 

15. (Previously Presented) A method for selectively shadowing only 
accesses to external storage media connected to a computer, the method 
comprising: 

detecting a data access to an external storage medium; 

writing a copy of the accessed data to a storage location other than the 
external storage medium; 

collecting the copy into a database where similar copies are collected; and 
querying the database; 
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wherein the detecting step comprises intercepting an I/O request from the 
computer to an external storage media drive in which the external storage media 
is inserted; 

wherein the database comprises records, each record comprising the 
copied data, a file name associated with the data, an identification of who 
initiated the data access, a station ID, and when the access was made. 

16. (Previously presented) The method of claim 14 wherein the computer is 
connected to a computer network, and the detecting and copying steps are 
performed at the computer, and the collecting and querying steps are performed 
at another computer on the network. 

17. (Previously presented) The method of claim 14 wherein the collecting 
and querying steps are performed by a user with administrator privileges. 

18. (Currently Amended) A computer readable storage medium on which 
is embedded computer software, the software performing a method, the method 
comprising: detecting a data access to an external storage medium; and writing a 
copy of the accessed data to a storage location other than the external storage 
medium without storing any intermediate copies or fragments thereof on the 
external storage medium : wherein the detecting step comprises intercepting an 
I/O request from the computer to an external storage media drive in which the 
external storage media is inserted. 

19. (Previously Presented) The computer readable storage medium of claim 
18 wherein the access is a write operation. 

20. (Canceled) 
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21. (Previously Presented) The computer readable storage medium of claim 
18 wherein the computer system runs under an operating system and the I/O 
request is one of the group consisting of IRP_MJ_CREATE, IRP_MJ_WRITE, 
IRP_MJ_CLOSE, IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MJ_READ 
packets. 

22. (Currently Amended) An apparatus for selectively shadowing only 
accesses to external storage media connected to a computer, the apparatus 
comprising: a detector that intercepts I/O requests from the computer to an 
external storage media drive in which the external storage media is inserted; 
and a storage, other than the external storage medium, connected to the 
detector, in which a copy of the accessed data is written without storing any 
intermediate copies or fragments thereof on the external storage media . 

23. (Previously presented) The apparatus of claim 22 further comprising 
one or more proxy handlers connected to the detector, wherein the proxy 
handlers handle certain I/O requests. 

24. (Previously presented) The apparatus of claim 23 wherein the certain 
I/O requests comprise IRP_M J_CRE ATE , IRP_MJ_WRITE, IRP_MJ_CLOSE 
and IRP_MJ_FILE_SYSTEM_CONTROL packet. 

25. (Previously presented) The apparatus of claim 24 wherein the certain 
I/O requests further comprise an IRP_MJ_READ packet. 
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26. (Previously presented) The apparatus of claim 23 further comprising: a 
list, connected to at least some of the one or more proxy handlers, in which file 
identifiers are contained. 

27. (Previously presented) The apparatus of claim 26 wherein the file 
identifiers are IRP.FsContext values. 

28. (Previously presented) The apparatus of claim 23 further comprising: 
one or more counters, connected to at least some of the one or more proxy 
handlers, by which certain file operations are counted. 

29. (Previously presented) The apparatus of claim 23 wherein the computer 
runs under an operating system, and the one or more proxy handlers are 
connected to I/O request packet drivers supplied by the operating system. 

30. (Canceled) 

31. (Previously Presented) The method of claim 1 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive. 

32. (Previously Presented) The computer readable storage medium of claim 
18 wherein the external storage medium is selected from the group consisting of 
a floppy disk; a writable CD, a removable hard disk drive, and a zip disk drive. 

33. (Previously presented) The apparatus of claim 22 wherein the external 
storage medium is selected from the group consisting of a floppy disk; a writable 
CD, a removable hard disk drive, and a zip disk drive. 
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